CVE-2025-27823: backdropcms mail disguise
Vulnerability summary
CVE-2025-27823 is a medium (CVSS 6.4) vulnerability in backdropcms mail disguise. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.6% of scored vulnerabilities.
Not severe (CVSS 6.4, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Timeline
- 07-03-2025PublishedVulnerability first disclosed.
- 07-03-2025Last modifiedVulnerability information updated.
Description
An issue was discovered in the Mail Disguise module before 1.x-1.0.5 for Backdrop CMS. It enables a website to obfuscate email addresses, and should prevent spambots from collecting them. The module doesn't sufficiently validate the data attribute value on links, potentially leading to a Cross Site Scripting (XSS) vulnerability. This is mitigated by the fact an attacker must be able to insert link (<a>) HTML elements containing data attributes into the page.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.24%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.24% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Backdropcms1 product
- mail disguise< 1.x-1.0.5
1 vendor · 1 product